CVE-2026-78323

Name	CVE-2026-78323
Description	A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1145877

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jss (PTS)	bookworm	5.3.0-1	vulnerable
	forky, sid	5.9.0~beta3-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jss	source	(unstable)	(unfixed)			1145877

Notes

[bookworm] - jss <postponed> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2521775
Fixed by: https://github.com/dogtagpki/jss/commit/cffadbb2b53157014bc2ffb46d5a8fd4979623d1 (master)